View online: https://www.drupal.org/sa-contrib-2026-051 Project: Advanced Content Feedback (aka admin_feedback) [1] Date: 2026-June-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Affected versions: <2.8.0 CVE IDs: CVE-2026-13231 Description: This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. The module doesn't sufficiently sanitize several administrator-configured response messages (the "Yes response", "No response", and the custom text shown on a "No" answer) under the scenario where those settings contain HTML or script markup, which is then emitted as raw HTML in the feedback response shown to visitors. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer admin feedback". Solution: Install the latest release: * If you use the admin_feedback module for Drupal 8.x, upgrade to admin_feedback 8.x-2.8 [3] The configured plain-text responses are now escaped with `Html::escape()`, and the formatted "No" response is rendered through its configured text format filter (`check_markup()`) instead of being printed raw. Reported By: * Bill Seremetis (bserem) [4] Fixed By: * Bill Seremetis (bserem) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team Security issue: https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_items/… [8] ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/admin_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_feedback/releases/8.x-2.8 [4] https://www.drupal.org/u/bserem [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://git.drupalcode.org/security/185233-admin_feedback-security/-/work_it... [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....